FIN7__2022__FIN7_TLPCLEAR.pdf

**Executive summary:** This PRODAFT report provides a comprehensive investigation of the FIN7 cybercrime/APT group, exposing its hierarchical organization, tailored tooling (Tirion/Lizar, custom PowerShell droppers, loaders), large-scale automated attack platform for Microsoft Exchange (ProxyShell/ProxyLogon) and SQLi, social-engineering (BadUSB, spear-phishing) methods, ransomware affiliations (REvil, DarkSide, LockBit), victim prioritization processes, post-exploitation toolset (SSH backdoors, Cobalt Strike, rclone exfiltration), and a lengthy set of IOCs and hashes useful for detection and response.